owasp-amass/amass · error

createAsset: status=

Error message

createAsset: status=%s error=%s

What it means

CreateAsset's informative variant: the server returned non-200 and its JSON error body parsed successfully, so the client surfaces the server's own error message alongside the HTTP status. The asset was not created.

Solutions

1. Read the error=%s message: it is the server's explanation of the rejection.
2. Ensure asset.AssetType() matches the endpoint type segment derived from it (client derives it automatically — verify the concrete asset type is supported).
3. Re-validate required asset fields before sending.
4. Re-authenticate if the server reported an auth failure.
5. Retry on transient 5xx statuses.

Example fix

// before
_, err := client.CreateAsset(ctx, token, asset)
// after
_, err := client.CreateAsset(ctx, token, asset)
if err != nil && strings.Contains(err.Error(), "status=409") {
    // asset already exists; treat as success or deduplicate first
}

if token == uuid.Nil { return errors.New("session token not initialized") }
if _, err := asset.JSON(); err != nil { return err }

func isServerError(err error) bool { return err != nil && strings.Contains(err.Error(), "status=5") }

id, err := client.CreateAsset(ctx, token, asset)
if err != nil {
    switch {
    case strings.Contains(err.Error(), "status=401"): token = reauth(ctx)
    case strings.Contains(err.Error(), "status=409"): /* dedupe */
    default: return err
    }
}

When it happens

Trigger: Calling Client.CreateAsset when the server rejects the asset — invalid session token (401), unknown asset type path (404), failed validation/storage (400/500) — with a well-formed JSON error body.

Common situations: Posting an asset whose fields fail server-side validation, using a token after session teardown, or a type mismatch between the asset and the URL segment.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• addAssetsBulk: status=
• /scope: status= error=
• addAssetsBulk: status=
• createAsset: status=
• createSession: status=

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/ac960cdf2e8e2578. Report an issue: GitHub.

Appendix: source

Thrown at engine/api/client/v1/client.go:240

	sessionID := token.String()
	u := fmt.Sprintf("%s/sessions/%s/assets/%s", c.base, sessionID, atype)
	resp, err := amasshttp.RequestWebPage(ctx, c.httpClient, &amasshttp.Request{
		URL:    u,
		Body:   string(raw),
		Method: http.MethodPost,
		Header: amasshttp.Header{"Content-Type": []string{"application/json"}},
	})
	if err != nil {
		return "", err
	}

	if resp.StatusCode != http.StatusOK {
		msg, err := readJSONError(resp.Body)
		if err != nil {
			return "", fmt.Errorf("createAsset: status=%s", resp.Status)
		}
		return "", fmt.Errorf("createAsset: status=%s error=%s", resp.Status, msg)
	}

	var r AddAssetResponse
	if err := json.Unmarshal([]byte(resp.Body), &r); err != nil {
		return "", err
	}
	return r.EntityID, nil
}

// Creates multiple assets in bulk on the server associated with the provided token.
func (c *Client) CreateAssetsBulk(ctx context.Context, token uuid.UUID, atype string, assets []oam.Asset) (int, error) {
	atype = strings.ToLower(strings.TrimSpace(atype))

	if atype == "" {
		return 0, fmt.Errorf("CreateAssetsBulk: asset type required")
	}
	if len(assets) > MaxBulkItems {
		return 0, fmt.Errorf("CreateAssetsBulk: too many items; max=%d", MaxBulkItems)

View on GitHub (pinned to 79299dce87)